Splunk Enterprise Security

Threat Activity in the ES app stopped to populate data

soumyasaha25
Contributor

i have recently upgraded SPlunk from 7.1.1 to 7.3.4 and ES from 5.2.2 to 5.3.1, but after the upgrade i can see that the threat activity dashboard does not show any data (data is only available till the time splunk was upgraded)
i can see that the Threat Intelligence Data Model is enabled and accelerated, but when i see "Data Model Audit" it still shows the date and time of the last time for which the dashboard shows data.
Also, i can see that the datamodels Web and network traffic do report data (there are the dependant data models for Threat intelligence data model)
Since its on my prod system, i have not yet tried to rebuild the data model, wanted to know if there is any other possible fix for this.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!